PoC: hidden content in the Privy sign-message confirmation

This page logs in a throwaway SIWE key generated in this tab on the test app cmwanou2701ch0fjnhkuzs4pv, creates one embedded wallet, and signs two messages. The second message begins with a harmless line and contains the real line below the fold of the signing screen's message box, which has no scrollbar. After signing, the page reports the box geometry at press time and recovers the signer, so the signature over the hidden content can be confirmed without leaving the page. First-load note: esm.sh can build packages on demand, and a lazy chunk can fail once with a CORS error. Reload the page if it does not start. The throwaway user and wallet are test objects on our own app. Nothing is transmitted except the SIWE signature and the two signing requests to Privy.